CVE-2015-7989

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-05-22 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.

Affected products

WordPress: through 4.3.0

References

http://www.debian.org/security/2015/dsa-3375
http://www.debian.org/security/2015/dsa-3383
http://www.securitytracker.com/id/1033979
https://codex.wordpress.org/Version_4.3.1
https://github.com/WordPress/WordPress/commit/f91a5fd10ea7245e5b41e288624819a37adf290a
https://security-tracker.debian.org/tracker/CVE-2015-7989
https://wordpress.org/news/2015/09/wordpress-4-3-1/
https://wpvulndb.com/vulnerabilities/8187
http://www.debian.org/security/2015/dsa-3375
http://www.debian.org/security/2015/dsa-3383
http://www.securitytracker.com/id/1033979
https://codex.wordpress.org/Version_4.3.1

Get alerted when CVE-2015-7989 or the next vulnerability affects your stack